CVE-2026-41917 is a local file inclusion vulnerability in OpenKM Community Edition 6.3.12 affecting the administrative scripting interface endpoint (/admin/Scripting). The vulnerability allows authenticated administrators to supply an attacker-controlled filesystem path via the fsPath parameter with action=Load, bypassing pathname restrictions and enabling arbitrary file reads. This can expose sensitive files including system password files, database credential configurations, and JVM keystores accessible by the OpenKM process. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond administrator, no user interaction, and high impact on confidentiality.

Successful exploitation allows an authenticated administrator to read arbitrary files on the server hosting OpenKM, potentially exposing sensitive system and application data such as user account information, database credentials, and cryptographic keystores. This could lead to further compromise of the system or data confidentiality breaches. The vulnerability does not require user interaction and has a medium severity rating with a CVSS score of 6.9. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative interface access to trusted personnel only and monitor for suspicious activity. Avoid exposing the administrative scripting interface to untrusted networks. Follow vendor communications for updates on patches or official mitigations.